The Garden Gnome Package plugin contains a DOM‑based cross‑site scripting flaw that improperly neutralizes user input, enabling an attacker to embed malicious JavaScript into a page served by the site. When a visitor loads that page, the injected script executes in the victim’s browser, allowing the attacker to run arbitrary code locally on the client side.

All releases of the Chief Gnome Garden Gnome Package plugin up to and including version 2.4.1 are affected. No other vendors or products are listed as impacted.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score below 1 % and absence from the KEV catalog suggest a currently low likelihood of exploitation. The flaw is client‑side and requires a victim to visit a crafted page or link, making it a single‑click attack vector. Despite the moderate risk, execution of arbitrary JavaScript could have significant impact if actively leveraged.